CVE-2023-45648

mediumpriority · track · 23EPSS 0.059 · 93 %ileDEEUNLRUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
5.88% (93rd) EPSS
CVSS 5.3 · medium
Is it mine?
174 products
Check your exposure
Who says so?
8 sources
cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-22

Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP trailer headers. A specially crafted, invalid trailer header could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. Older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fix the issue.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

02

cvss

Technical severity, 0–10. One row per scoring source.

7.5
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5.2–7.5

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Nprimary · NVD / NIST USexploitability 3.9 · impact 1.4
v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:Csecondary · CISA US
v3.15.3mediumAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Nsecondary · FSTEC (BDU) RU
v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Nsecondary · ENISA EU
v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Nsecondaryexploitability 3.9 · impact 1.4
v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Nsecondary · OSV
v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:Csecondary · Siemens ProductCERT DE
v3.15.2mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:Fsecondary · CVSS-BT (t0sche)
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · NCSC-NL NL
03

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS
04

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-20USCWE-20USCWE-20USCWE-20USCWE-20USCWE-20US
05

affected products (174)

Products and version ranges known to be affected.

showing 20 of 174
06

advisories (12)

Vendor and ecosystem advisories describing this.

  • NCSC-2024-0332Kwetsbaarheden verholpen in Siemens productenNL2024-08-13csaf · ncsc_nlNL

    Siemens heeft kwetsbaarheden verholpen in diverse producten als COMOS, INTRALOG, LOGO!, NX, SCALANCE, SINEC en Teamcenter.

  • NCSC-2025-0123Kwetsbaarheden verholpen in Oracle Database ProductenNL2025-04-16csaf · ncsc_nlNL

    Oracle heeft kwetsbaarheden verholpen in diverse Oracle Database Producten en subsystemen, zoals Oracle Server, NoSQL, TimesTen, Secure Backup en Essbase.

  • SSA-784301SSA-784301: Multiple Vulnerabilities in SINEC NMS Before V3.02024-08-13csaf · siemens_psirtDE

    SINEC NMS before V3.0 is affected by multiple vulnerabilities. Siemens has released a new version for SINEC NMS and recommends to update to the latest version.

  • WID-SEC-W-2023-2628Apache Tomcat: Mehrere SchwachstellenDeutsch2023-10-10csaf · cert_bundDE

    Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Apache Tomcat ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen, Sicherheitsmaßnahmen zu umgehen oder vertrauliche Informationen offenzulegen.

  • WID-SEC-W-2023-2963Trellix ePolicy Orchestrator: Mehrere SchwachstellenDeutsch2023-11-16csaf · cert_bundDE

    Ein entfernter Angreifer kann mehrere Schwachstellen in Trellix ePolicy Orchestrator ausnutzen, um sich administrative Rechte zu verschaffen, um einen Redirect-Angriff auszuführen und um nicht näher spezifizierte Auswirkungen zu erzielen.

  • WID-SEC-W-2024-0106Oracle Communications: Mehrere SchwachstellenDeutsch2024-01-16csaf · cert_bundDE

    Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Communications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

  • WID-SEC-W-2024-0107Oracle Communications Applications: Mehrere SchwachstellenDeutsch2024-01-16csaf · cert_bundDE

    Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Communications Applications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

  • WID-SEC-W-2024-0528Dell Data Protection Advisor: Mehrere SchwachstellenDeutsch2024-02-29csaf · cert_bundDE

    Ein Angreifer kann mehrere Schwachstellen in Dell Data Protection Advisor ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Berechtigungen zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.

  • WID-SEC-W-2024-1238HPE HP-UX: Mehrere SchwachstellenDeutsch2024-05-27csaf · cert_bundDE

    Ein anonymer oder lokaler Angreifer kann mehrere Schwachstellen in HPE HP-UX Tomcat Servlet Engine ausnutzen, um Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand zu verursachen, vertrauliche Informationen offenzulegen oder Dateien zu manipulieren.

  • GHSA-r6j3-px5g-cq3xApache Tomcat Improper Input Validation vulnerability2023-10-10ghsa · osvUS

    Improper Input Validation vulnerability in Apache Tomcat. Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP trailer headers. A specially crafted, invalid trailer header could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. Older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fix the issue.

  • ICSA-24-228-06Siemens SINEC NMS2024-08-13icsa · cisa_csaf_otUS

    SINEC NMS before V3.0 is affected by multiple vulnerabilities. Siemens has released a new version for SINEC NMS and recommends to update to the latest version.

  • BIT-tomcat-2023-45648Apache Tomcat: Trailer header parsing too lenient2024-03-06vendor · osvUS

    Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0 through 11.0.0, from 10.1.0 through 10.1.13, from 9.0.0 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP trailer headers. A specially crafted, invalid trailer header could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. Older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fix the issue.

07

also known as (6)

Other names and identifiers for this entity.

08

sources

Which sources assert this record, and when.

cnnvdenisa_euvdfstec_bduosvcert_bundncsc_nlsiemens_psirtcisa_csaf_otNVDCVE.orgMITRE
published 2023-10-10modified 2026-09-23
09

references (20)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan